Privacy policy

This policy explains what personal data Chasca (“Chasca”, “we”, “us”) collects when you visit trychasca.com, use the Chasca app at app.trychasca.com, or use the Chasca API, SDK, command-line tool or MCP server (together, the “Service”); why we collect it; who processes it for us; how long we keep it; and the choices and rights you have. It applies to everyone who uses Chasca, wherever they live.

Chasca turns a prompt, a document, a web page or an image into a narrated whiteboard explainer video. To do that we have to read what you give us, write a script, draw the scenes, record a narration and render a video file. This policy describes each of those steps in plain terms.

1. What we collect

Information you give us

• Account details: your name, your email address and your password. We store passwords only as a salted hash, never in readable form. We also record whether you have confirmed your email address.
• If you sign in with Google: the name, email address and profile picture of your Google account. Section 3 explains exactly how we use them.
• What you give us to make a video: your prompts and instructions; documents and text you upload or paste; web addresses you ask us to read; images; reference videos and recordings you upload so a new video can match their style; and the settings you choose, such as language, voice, length, format, captions and pace.
• Voice dictation: if you use the microphone button to speak a prompt, the recording of what you say. It is used only to write your words into the prompt box (see section 2).
• Branding: a logo, colours and fonts, if you set up branding for your videos.
• Messages to us: problem reports and feedback you send from the app, and anything you write in the “Talk to us about pricing” form on our website (your email, how you would use Chasca, and optional volume, budget and notes).

What the Service creates for you

• Scripts, scene plans, narration audio, captions and subtitles, the finished videos with their posters and thumbnails, earlier versions you have edited, and quality checks on each video.
• Records of each video’s progress, the minutes it used, and the cost of the AI requests made to produce it.

Information collected automatically

• Sign-in and security data: the sessions that keep you signed in, with the IP address and browser each session was started from.
• Usage records: which videos you made, how they were made (in the app or through the API), minutes used, your plan and its payments, renewals, cancellations and refunds, credits from our referral programme, API keys you created (stored as a hash) and share links you turned on, with a daily count of how often each shared video was viewed.
• Where visits come from: the first page of each visit to our website or app, the site or tagged link that brought you there, and a visitor code that changes every day (see section 9).
• Server logs: technical records of requests to our servers, used to keep the Service running and secure.

When you buy a plan, payment is handled by Dodo Payments, our Merchant of Record. You enter your card or other payment details on its checkout, not on Chasca, and we never see or store your full card number. Dodo Payments tells us what we need to run your plan: whether a payment succeeded, the plan and amount, the email address and country used, and its own reference for the subscription.

2. How we use it

• To make your videos: to read your sources, write and check a script, plan and draw the scenes, record the narration, add captions and render the video, then store it and deliver it to you.
• To read links: when you give us a web address, our servers open that public page the way a browser would and copy its text to use as the source of your video. We only read pages that load without a login.
• To understand reference uploads: when you upload a reference video, recording or image, we transcribe its speech and describe its drawing style, captions and voice, so the new video can match it. We show you what was understood before anything is made.
• To write down dictation: a dictated recording is converted to text by a speech-to-text model and deleted from our servers as soon as it has been written down.
• To run your account: to sign you in, confirm your email address, reset your password, keep track of your plan, free videos, minutes and referral credits, run your API keys, and show a video to anyone with its share link once you turn that link on.
• To send emails your account needs: confirmation links, sign-in links and password resets.
• To keep Chasca safe and working: to prevent abuse and fraud, enforce plan limits and rate limits, protect accounts, and find and fix failures. When you report a problem with a video, our team may look at that video, its prompt and its script to fix it.
• To improve Chasca: to learn which features are used and how well videos turn out, mostly from aggregate numbers such as render times, failure rates and automatic quality scores.

We do not sell your personal data, we do not use it for advertising, and we do not use your prompts, files, recordings or videos to train AI models.

Legal bases (European Economic Area and United Kingdom)

We process personal data to perform our agreement with you (making and delivering videos, running your account); for our legitimate interests in keeping the Service secure, preventing abuse and improving it, balanced against your rights; to meet legal obligations; and with your consent where the law requires it, which you can withdraw at any time.

3. Google user data

You can sign in to Chasca with your Google account. When you do, Google asks for your permission to share your basic profile with us, and we receive only what these permissions allow: your name, your email address and your profile picture (the openid, email and profile scopes). We do not ask for access to your Gmail, Google Drive, Calendar, contacts or any other Google data.

• How we use it: only to create your Chasca account, sign you in, show your name and picture in the app, and send the emails your account needs to that address.
• How we store it: in our account database, together with the rest of your account, protected as described in section 7.
• How we share it: we do not sell it, use it for advertising, or share it with anyone except the service providers in section 4 that are needed to run your account (for example, our email provider receives your email address to deliver an email to you), or when the law requires it.
• No AI training: we do not use Google user data to develop, improve or train AI or machine-learning models.
• Removing it: deleting your Chasca account deletes this data. You can also remove Chasca’s access at any time in your Google Account under Security, “Third-party apps and services”.

Chasca’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Who processes it for us

We use service providers to run Chasca. They process personal data on our behalf, only to provide their service to us:

• AI model providers, reached through OpenRouter (an AI routing service): language models that read your sources and write and check scripts; speech-to-text models that write down dictation and reference recordings; a vision model that describes reference images and video frames; and a text-to-speech model (currently Google’s Gemini speech model) that records the narration. They receive what is needed for each step: your prompt, the text of your documents or links, reference images and frames, recordings, and the script. They never receive your password. Their own terms may allow them to keep requests for a limited time for security and abuse monitoring.
• Microsoft’s speech service: a backup narration voice used if the main one is unavailable. It receives the script text to be read aloud.
• Hosting provider: the cloud server that runs our app, our database and the storage for your files.
• Resend: delivers the emails your account needs. It receives your email address and the email’s content.
• Google: when you choose to sign in with Google (see section 3).

Dodo Payments, our Merchant of Record, processes payments, taxes, receipts and refunds for paid plans on its own account and under its own privacy policy, not on our behalf.

We may also disclose personal data if the law requires it, to protect the rights, safety or property of people or of Chasca, or as part of a merger, acquisition or sale of the Service, in which case this policy continues to apply to your data.

5. Where your data is processed

Chasca and its providers may process data in countries other than yours, including India, the United States and countries in the European Union. Where the law sets conditions for such transfers, we follow them.

6. How long we keep it

• Account details: while your account is open.
• Videos, uploads and branding: until you delete them or close your account. Deleting a video removes its video file, narration, poster and other files straight away and turns its share link off; a short record of it (its title and prompt) stays with your account until the account is closed.
• Dictation recordings: deleted as soon as they have been written down.
• Closing your account: you can delete your account in the app under Settings, Account. It is closed at once: you are signed out everywhere, you cannot sign in to it again, its share links and API keys stop working and a paid plan is cancelled. Its data (your videos and their files, your uploads and your account details) is kept for up to 90 days for review, legal and compliance needs (such as payments and disputes), then deleted. Copies in backups, if any, are overwritten in the normal course. You can create a new account with the same email address 24 hours after deleting the old one.
• Visit records: they contain no account details; we keep them to see how visits change over time.
• Server logs: for a limited time, then deleted.
• Payment records: for as long as tax and accounting laws require, which can be after an account is closed.
• Messages you send us: as long as we need them to answer you and to keep a record of billing and refund requests.

7. Security

We use encrypted connections (HTTPS) everywhere; store passwords and API keys only as hashes; serve video files through signed links that expire; keep each account’s videos visible only to that account unless you turn on a share link; run the app under limited permissions; and restrict access to production data to the people who run Chasca. No system is perfectly secure, so please use a strong password, keep your API keys secret and share video links only with people you trust. Anyone who has a share link you turned on can watch that video until you turn the link off.

8. Your choices and rights

In the app you can, at any time:

• download your videos, and delete videos you no longer want;
• turn share links on and off;
• change your name and default settings;
• delete API keys; and
• delete your account (its data is then kept for up to 90 days, as section 6 explains).

Depending on where you live, you may also have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• object to some uses of your data, or ask us to restrict them;
• receive your data in a portable format;
• withdraw a consent you have given; and
• complain to a data protection authority: in the European Union or the United Kingdom, the supervisory authority where you live; in India, the Data Protection Board of India.

California residents also have the right to know what personal information we collect, use and disclose, to ask us to delete it, to correct it, and not to be treated differently for using these rights. We do not sell personal information and do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you.

We answer requests within the time the law allows and may need to confirm your identity first, usually by asking you to send the request from your signed-in account.

9. Cookies, local storage and how we learn where visitors come from

Cookies. The Chasca app uses one essential cookie to keep you signed in. Our marketing website sets no cookies. Neither runs advertising or third-party analytics or tracking scripts, and the website serves its fonts itself.

Where visits come from. When a visit starts, the website and the app tell our own server which page it started on and which site or tagged link brought you there (for example a search engine, an AI assistant, a social network or a newsletter), and we store that in our own database. We never store the rest of the address you visited. Your IP address and browser are turned into a code that changes every day and cannot be turned back, so we can count visitors without knowing who they are.

Local storage. Your browser keeps that first visit for 30 days, so that if you sign up we know which site or page brought you, and we note it on your new account once. The app also keeps a few preferences in your browser’s local storage, on your device: your theme, your last video options, how your library is shown, a referral code or plan you arrived with, and that first visit. You can clear them at any time in your browser settings.

10. Children

Chasca is not directed to children. You must be at least 13 years old to create an account, or older if the law where you live sets a higher age for using online services without a parent’s permission (for example 16 in some European countries, or 18 in India). Teachers can use Chasca to make videos for their classes without students needing accounts. If we learn that a child has given us personal data without the required permission, we delete it.

11. Changes to this policy

We may update this policy as Chasca changes. The date at the top shows the latest version. Before a significant change takes effect, we will tell you in the app or by email.

12. Contact

For questions about this policy or your data, or to use any of the rights above, sign in and send a message from Feedback in the app (choose Question); our contact page explains how. We reply by email to the address on your account. You can also download or delete your videos and delete your account yourself at any time, as described in section 8.